)]}'
{
  "commit": "7e0885dfe3e295145e1b0e195e5893a27295e471",
  "tree": "c0c499b3e77921dc0635da4446b29b32868f1ae7",
  "parents": [
    "95347ca1b5b9379f44d1d091514514c4ac32d029"
  ],
  "author": {
    "name": "Richard Levasseur",
    "email": "richardlev@gmail.com",
    "time": "Sun Nov 01 13:45:26 2026 -0800"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Sun Nov 01 13:45:26 2026 -0800"
  },
  "message": "workflows: resolve code-scanning alerts and harden security guardrails (#4399)\n\nAdd explicit least-privilege permissions across GitHub Actions workflows\nto resolve actions/missing-workflow-permissions findings (#23, #25, #30,\n#36, #37, #43).\n\nRemove workflow_dispatch from release_build_artifacts.yaml and drop\nfreeform input from publish_pypi.yaml to eliminate cache poisoning via\nuntrusted ref checkout (#40, #41). Validate release tags in\npublish_pypi.yaml prior to checkout and caching.\n\nSwitch URL substring checks in developer agent scripts to strict netloc\nverification via urllib.parse.urlsplit (#19, #20).\n\nRename mock tokens in uv_lock_pypi_server.py to avoid heuristic\nsensitive naming, and document intentional mock logging with CodeQL\nsuppressions (#17, #18).\n\nEnforce these security invariants in agent rules and code review\nprompts.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4b489e57d23d89ba594dab549ca7065313f251a9",
      "old_mode": 33188,
      "old_path": ".agents/rules/github_actions_workflows.md",
      "new_id": "820579a34ed388e31bc5fb476e403583c1b2e04f",
      "new_mode": 33188,
      "new_path": ".agents/rules/github_actions_workflows.md"
    },
    {
      "type": "modify",
      "old_id": "40049b9734cf3726eb1ef9803f8e4a84a9c69be3",
      "old_mode": 33188,
      "old_path": ".agents/rules/python.md",
      "new_id": "312fb428c08886b7e49e8d8ead7eeee7eb072093",
      "new_mode": 33188,
      "new_path": ".agents/rules/python.md"
    },
    {
      "type": "modify",
      "old_id": "9abddce3bbb4e741eaca6a79d2bdc2de961f9e70",
      "old_mode": 33261,
      "old_path": ".agents/skills/analyze-ci-failure/scripts/analyze_ci_failure.py",
      "new_id": "a44739466492758c36cbb86a65cf632c7a7b6e07",
      "new_mode": 33261,
      "new_path": ".agents/skills/analyze-ci-failure/scripts/analyze_ci_failure.py"
    },
    {
      "type": "modify",
      "old_id": "e45273adac1160b93490fa68e2db7a5e3adcc82b",
      "old_mode": 33261,
      "old_path": ".agents/skills/buildkite-get-results/scripts/get_buildkite_results.py",
      "new_id": "aa5b81ea5c6815ee21d886a567b1629ddb1d7c7c",
      "new_mode": 33261,
      "new_path": ".agents/skills/buildkite-get-results/scripts/get_buildkite_results.py"
    },
    {
      "type": "modify",
      "old_id": "3efe3263cc44dd5d7848e95bbe06bd705b8da3a3",
      "old_mode": 33188,
      "old_path": ".agents/skills/review-code/review-python-prompt.md",
      "new_id": "672aeed7f066b048bb7794e85c49e9974f614758",
      "new_mode": 33188,
      "new_path": ".agents/skills/review-code/review-python-prompt.md"
    },
    {
      "type": "modify",
      "old_id": "01620154580b5273f8dddf6d09c9fd9534818fef",
      "old_mode": 33188,
      "old_path": ".agents/skills/review-code/review-workflows-prompt.md",
      "new_id": "8510b9beea380b38b07b17dac2234514ffe0adfb",
      "new_mode": 33188,
      "new_path": ".agents/skills/review-code/review-workflows-prompt.md"
    },
    {
      "type": "modify",
      "old_id": "67b3b77649377612d5b80c65bce84c5f74e57c85",
      "old_mode": 33188,
      "old_path": ".github/workflows/pr-metadata-checks.yaml",
      "new_id": "046bb228f99d7ca85e161bc35b377df31ade5a76",
      "new_mode": 33188,
      "new_path": ".github/workflows/pr-metadata-checks.yaml"
    },
    {
      "type": "modify",
      "old_id": "d2b2f342398968d8b1948bfe17885289a4ac2676",
      "old_mode": 33188,
      "old_path": ".github/workflows/publish.yml",
      "new_id": "a64ed3379bc4c97453f1f56aced147f8417748f8",
      "new_mode": 33188,
      "new_path": ".github/workflows/publish.yml"
    },
    {
      "type": "modify",
      "old_id": "6273c526ffdcbb39ca1a1d736da5e9996b604530",
      "old_mode": 33188,
      "old_path": ".github/workflows/publish_pypi.yaml",
      "new_id": "f7811d06a5c4a539dc5c5d981f1f6fac970e20ff",
      "new_mode": 33188,
      "new_path": ".github/workflows/publish_pypi.yaml"
    },
    {
      "type": "modify",
      "old_id": "b4ea7fd24646ca983470ecd8daf20203a9e55857",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_build_artifacts.yaml",
      "new_id": "65d4fca440c1a15b6a01947f132b05ad734cb2a0",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_build_artifacts.yaml"
    },
    {
      "type": "modify",
      "old_id": "4b64bc5f3ebc52617abbeef76dcd1e7fe1ccfd71",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_publish.yaml",
      "new_id": "19d83800e95544cc81d7f86553e13205419aca35",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_publish.yaml"
    },
    {
      "type": "modify",
      "old_id": "4b687ba58d506a50c76dbacc1df1106bb740ca1f",
      "old_mode": 33188,
      "old_path": "RELEASING.md",
      "new_id": "4bf9440f5e1d0f3722ef731494f01e46a6249c55",
      "new_mode": 33188,
      "new_path": "RELEASING.md"
    },
    {
      "type": "modify",
      "old_id": "1f350b809f8ebd9369359f9a25be91005f2aec3a",
      "old_mode": 33188,
      "old_path": "tests/integration/uv_lock_pypi_server.py",
      "new_id": "0d7c948ca7c88f45f2bbbb47f729d614bb438819",
      "new_mode": 33188,
      "new_path": "tests/integration/uv_lock_pypi_server.py"
    },
    {
      "type": "modify",
      "old_id": "d0a7279c73a12faa9f44497c2fc2ca7561dfa8ac",
      "old_mode": 33188,
      "old_path": "tests/workflows/release_build_artifacts_test.py",
      "new_id": "6acc1c4518c983ec91c79137ca43d2d2d8db94a9",
      "new_mode": 33188,
      "new_path": "tests/workflows/release_build_artifacts_test.py"
    }
  ]
}